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We present a novel attack on quantum key distribution based on the idea of adaptive absorption 
ml . The conditional beam splitting attack is shown to be much more efficient than the conventional 
beam spitting attack, achieving a performance similar to the, powerful but currently unfeasible, 
photon number splitting attack. The implementation of the conditional beam splitting attack, 
based solely on linear optical elements, is well within reach of current technology. 



I. INTRODUCTION 

The use of quantum effects extends our communication 
capabilities beyond the solutions offered by classical com- 
munication theory. A prominent example is quantum key 
distribution (qkd) which allows to expand a small initial 
secret key shared between two parties into a larger secret 
key. This task, which cannot be accomplished within 
classical communication theory, enables the two parties 
to exchange secret messages via the encryption technique 
of the one-time pad S. The idea has been introduced by 
Wiesner [gj and the first complete protocol for qkd has 
been given by Bennett and Brassard B. 

In a quantum optical implementation, the sender (Al- 
ice) encodes a random bit value "0" and "1" in the 
orthogonal polarization states of a single photon. She 
chooses at random either a linear or a circular polariza- 
tion basis. The receiver (Bob) uses a polarization bases 
chosen at random from these two bases. In the follow- 
ing classical communication, Alice and Bob identify those 
signals for which they used the same basis, and the cor- 
responding bit values form the sifted key. Either due to 
noise or due to eavesdropping, Alice's and Bob's version 
of the sifted key differ. As long as the error rate is be- 
low some threshold, they can correct these errors and 
perform privacy amplification l5l to obtain a secure key. 
The theoretical security analysis of this scheme has been 
a subject of intense research and only recently a full proof 
of security for the whole protocol has been given 0-0] . 

A first implementation of this protocol |l3| demon- 
strated the feasibility of this scheme. Since then, many 
groups improved the implementations. State of the art 
schemes can maintain the coherence of the system over 
distances as far as 50 km. However, the signals used in 
these implementations are not single photon signals. In- 
stead, weak coherent pulses (wcp) are used with typical 
average photon numbers of 0.1 or higher. The signals are 
described by coherent states in the chosen polarization 
mode. This modification of the signals together with the 
large loss of the fiber optical implementations over long 
distances opens a security loophole ||ll| . The restrictions 
on practical implementations imposed by the use of wCP 



signals has been demonstrated u^ , giving a limit on the 
distance over which qkd can be performed as a function 
of Bob's detection efficiency and dark count rate. Never- 
theless, it has been shown that, despite these restrictions, 
it is still possible to obtain a secure key | p^ , p^ 

The key process which makes Eve very powerful if Al- 
ice and Bob use wCP signals is the photon number .split- 
ting attack (PNS) [|l2|,Q. In this attack Eve performs a 
quantum non-demolition measurement (qnd) of the total 
number of photons of the signal. Whenever she finds that 
a signal contains two or more photons, she deterministi- 
cally takes one photon out of the signal. The remaining 
photons of the signal are then forwarded over a lossless 
channel to Bob. For a wCP with mean photon number fx, 
sent by Alice, Eve obtains a single photon in the same po- 
larization state as those in the signal reaching Bob with 
probability 
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Eve now can delay the measurement on that photon until 
she learns the polarization basis of each signal, thereby 
learning the bit value for each signal. In order to ensure 
that Bob does not get too many signals compared to the 
installed lossy quantum channel. Eve can actually block 
some signals completely, starting with the initial one- 
photon signals which cannot be split. We find that this 
strategy gives the complete key to Eve once the losses of 
the installed quantum channel are so high that she can 
block all single photon signals. 

This splitting process used in the PNS attack is allowed 
by quantum mechanics, but the implementation is out of 
reach of current technology. Therefore earlier analyses of 
this situation made use of the beam splitting attack (bs) 
which has the appeal of simplicity and feasibility. The 
basic concept uses the idea that a lossy quantum channel 
acts like a combination of a lossless channel and a beam 
splitter which accounts for the losses. Eve monitors the 
second output arm of the beam splitter and will gain the 
complete knowledge of a bit of the sifted key (via a de- 
layed measurement) if a multi-photon signal is split such 
that Bob and Eve both get at least one photon of the 
signal. The central quantities are the probability that 



Bob receives a non- vacuum signal 



(2) 



where rj is the single photon transmission efficiency of 
the quantum channel. The probability that Bob and Eve 
both receive a signal is 

p|r = [1 - exp i^firj)] [1 - exp (-^(1 - v))] ■ (3) 

Despite its simplicity and perfect simulation of the lossy 
channel, the beam splitter attack is very ineffective when 
replacing channels with large losses, i.e. large transmis- 
sion distances. In that case, for example, two photon sig- 
nals are more likely to see both photons being directed to 
Eve (and therefore becoming useless) rather than being 
split. 

In |l[] the authors present the idea of adaptive absorp- 
tion. This consists of sending a photonic signal through a 
linear absorber in which absorption events can be contin- 
uously monitored in such a way that as soon as a single 
photon is absorbed, a feed-forward mechanism decouples 
the signal from the absorbing medium. With this simple 
procedure it is possible to extract precisely one photon 
from a field-mode prepared in any state (other than the 
vacuum, of course). In this paper we show how the idea of 
adaptive absorption leads to the conditional beam split- 
ting attack (CBS) on weak coherent pulse QKD. By using 
only linear optical elements, the CBS reduces the number 
of events where more than one photon is split off. This 
allows an eavesdropping efhciency that overwhelms the 
conventional beam splitting attack and can be as large 
as the ones given by the PNS. 

The paper will be organized as follows. In Sec. O we 
describe the CBS attack and introduce the quantum jump 
method, which in turn will be used to calculate the state 
of the signal during the various stages of the attack. The 
results will allow us to compare the performances of the 
CBS and the conventional BS attack. For sake of simplic- 
ity this will be done in the scenario in which the eaves- 
dropper is able delay her measurement until the encoding 
basis is announced by Alice [n5|. In Sec. Ill we consider 



the more realistic situation in which Eve docs not have 
the technological skills to store photons, and introduce a 
variation of the CBS where Eve tries to split two single 
photons from the signal before forwarding it to Bob. In 
Sec. IV we study the photon statistics in Bob's detectors 



and see that in principle Alice and Bob could use this 
information to disclose Eve's attack. The possibility of 
improving the CBS attack by using mixed strategies will 
be investigated in Sec. M. 



VI 



we rederive some 



In Sec. 
basic results for finite beam splitters and compare them 
with the ones obtained using the quantum jump method. 



through polarized coherent states with very low mean 
photon number (instead of single photons). To do that 
Eve will weakly couple her modes to the signal modes and 
try to extract one excitation from the signal sent by Alice. 
As soon as she gets one photon into her modes, Eve will 
allow any remaining signal photons to reach Bob through 
an ideal channel. Otherwise she will keep on trying for 
a longer time. If she does not succeed after a maximum 
coupling time r, Eve will directly send the signal to Bob 
through the ideal channel. 

After Alice announces publicly the encoding basis used 
to send each of the bits. Eve can measure her photon to 
learn the bit value of transmitted signal |l^ . Only in the 
cases where the multiphoton signal is split in such a way 
that both Eve and Bob receive a non- vacuum signal, will 
the bit value learned by Eve form part of the sifted key 
shared between Alice an Bob. We will therefore refer to 
the probability of this event as the probability of success 
of the CBS (PcBs'^)- Since this attack does not produce 
any qubit errors, we will take the probability of success 
as a figure of merit for the attack. On the other hand, in 
order to remain unnoticed. Eve's attack has to be such 
that the number of non-vacuum signals that arrive to 
Bob agrees with what he expects from the lossy chan- 
nel. Hence, the probability i^c^jsi^O] that Bob receives a 
non-vacuum signal fixes a bound on the eavesdropping 
attack. The probabilities Pcbs'^ ^^'^ ^cbs[^0] "^iU be the 
central quantities when evaluating the attack. 

In Fig.|l] a possible implementation of the CBS is shown. 
The initial state sent by Alice occupies only two pho- 
tonic modes (a and 6) corresponding for example to the 
two polarization degrees of freedom of a traveling mode. 
Conditional beam splitting consists of sending the input 
state to a polarization independent weak beam splitter. 
A measurement to determine if there are any photons 
is then done in the weakly coupled output arm (modes 
fle and be)- If no photon is detected the signal is sent 
through an identical beam splitter again. Otherwise the 
signal is transmitted through a perfect channel without 
any further processing. 
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Sec. VII concludes the paper with a brief summary. 



FIG. 1. Possible experimental realization of the conditional 
beam splitting attack. 



II. CONDITIONAL BEAM SPLITTING ATTACK 

As mentioned in the introduction the hope is to take 
advantage of the fact that the signal bits are implemented 



To investigate this procedure we will take the limit of 
infinitesimally weak beam splitting which will allow us to 
take results from quantum jump methods |Qq-E8[ as we 
did for the study of adaptive absorption [||. In Sec. ^ we 



will give some numerical results for finitely weak beam 
splitters. Quantum jump methods are wave function (as 
opposed to density matrix) approaches to study the evo- 
lution of small systems coupled to a large reservoir. In 
addition to being a very powerful method it has a nice 
physical interpretation: The stochastic evolution of the 
wave function corresponds to the stochastic read outs of 
the continuously monitored reservoir. 

We preface our analysis with a brief review of the quan- 
tum jump approach to open systems. Suppose that ini- 
tially the system is in the state \4>{0)). If no jump occurs 
the evolution of the system is described by the effective 
Hamiltonian, H^s = Hs - \ Y.ra J^Jm, 



k°W) = e 



-j-ffci 



\H0)) 



(4) 



Here Hs is the Hamiltonian of the isolated system and 
the Jm's are the jump operators which account for the 
coupling to the reservoir. Since the effective Hamiltonian 
is not hermitian, this state |</>''(i)) is not normalized. The 
square of its norm gives the probability of having no jump 
after a time t. 



Po(i) = WO)|e^^-' 



i-Wci 



\H0)) 



(5) 



If a jump to a mode m occurs in a time between t and 
t + 5t then the system will be in the state 



(6) 



\^^{t+st))^vdtj^m)) 



immediately after this period. And again the probability 
of this event is given by the square of the norm of the 
conditional state, 



6pm{t)^m)\jlJrnm))dt 



(7) 



Using these probabilities one can follow the history of 
the system's wave function when the reservoir is contin- 
uously monitored to detect what kind of jump occurred 
or if any jump occurred at all. It can be shown that by 
averaging over different histories the state of the system 
at a given time t, one recovers the master equation 

— = -i[Hs, p]- - J^iJliJrnP + pjLJm) 



dt ' "^' 2 



(8) 



for the system density operator p. The first term in this 
equation describes the standard unitary evolution of the 
system. The last two terms describe the relaxation pro- 
cess due to the coupling of the system to the reservoir. 
In order for this description to be true, the coupling and 
the reservoir have to be such that the jump probability 
5pm{i) is very small and does not depend on the previous 
history of the system. 

In this paper we use the quantum jump method to 
study the evolution of the system formed by the signal 



modes (a and h), and Eve's modes (oe and h^). The ac- 
tion of the infinitesimally weak beam splitting together 
with a measuring device that checks if the number of 
photons in Eve's modes has increased will play the role 
of reservoir being continuously monitored. An increase 
in the photon number in Eve's modes is then represented 
by the jump operator 

J^e{a\a + blb), (9) 



where e <C 1 is the reflection coefficient of the weak beam- 
splitting. After this jump the photons in Eve's modes and 
the signal photons will be in a shared wave ftinction. If 
no jump occurs Eve's modes will remain in the vacuum 
state. 

The initial state is given by 



|0(O)) = |a;/3)|O;O), 



(10) 



where the first two modes are the signal modes initially 
in a coherent state and with a definite polarization, and 
the last modes are Eve's modes. The mean photon num- 



ber of the signal sent by Alice is p = |q;| 



If Eve 



does not intervene then the signal that Bob will receive 
after going through the lossy channel is 



|O = IV^a;V^/3)|0;0), 



(11) 



where rj is the transmissivity of the channel. This means 
that the probability that Bob gets a non-vacuum signal 

is 



P^[^0] = 1 - P^S[0] = 1 - exp(-^r/). 



(12) 



where P^ [0] is the probability of Bob getting the vacuum 
signal. 

We now proceed to calculate what happens when Eve 
tries to eavesdrop on the signal using the conditional 
beam splitting attack (CBS). At time to = Q Eve starts 
a conditional beam splitting attack on the signal sent by 
Alice. The conditional state of the system after a time t 
when no photon has been detected in Eve's modes is 



k°(t)) 



-t^.rj 



10(0)) 



-(n„+nb) 



p3(7?-1)m 



;/3)|0;0) 
7ta;7t/3)|0;0), 



(13) 



where we have defined 7* = exp( — |-) and used the nor- 
mal ordered form of the exponential of the number opera- 
tor |19|| . The squared norm of this state is the probability 
of detecting no photon in Eve's mode after a time t. 



Po{t) = {^'{t) |0O(t)) = e(^?-i)^ 

If the first jump occurs in the time interval [t, t 
then the conditional state of the system is 

\(j)\t + dt))^Je''--'^''^\cj){{))) 
^e^(^'^i)''J|7ua;7t/?)|0;0) 



(14) 



^fAiy^t'^)!^ 



e7tj7ta;7t,/?)(a|l;0)+/3|0;l)). (15) 



The probability density of detecting a photon in Eve's 
modes at the time interval [t, t + 5t] is therefore given by 



Pi(t) = (^^(i)|0'W)=f'7?,A*e«-i)^ 



(16) 



As already mentioned, the first thing that Alice and 
Bob will check to detect the presence of Eve, is that Bob 
receives a fraction of non- vacuum signals consistent with 
the lossy channel, given in (|lj). That is. 



^c^BshO]=P,fhO] or P^,A^]^P^[Q]. 



(17) 



The total probability that after the CBS attack Bob gets 
a vacuum signal is 

^l,s[0]-Po(r)|(0;0|7ra;7r/3)|' + 



+ / pi(i)|(0;0|7ta;7t/3)|^di 
/o 

"/J/i I ../'I -.2\ 



'(l+Ml-7r)), 



(18) 



where we have made use of Eqs. (O) and (p^. With 
the results of Eqs. (|l2|) and ( |l8| ) we find the required 
value of the coupling time r so that condition expressed 
in Eq. (0) is fulfilled. 



hi 



aA'(l-'7)\ 



(19) 



Notice that 7^ < 77. 

In order to quantify the performance of the CBS we 
will now calculate the probability of a successful split- 
ting PcBs'^- This is the probability that Eve manages to 
extract one photon from the signal and still leaves at 
least one photon for Bob. Splittings that leave the trans- 
mitted signal in the vacuum state are not useful to Eve 
since these bits will not contribute to the sifted key. The 
success probability for the CBS attack is given by 



succ 
-FCBS 



EB 



{plsm + pLm-p 

e-^(l+M(l-72))-e(T' 
Me-''(l-7')-e~(i-^')'' 



[0,0]) 



(20) 



(21) 



where P^^g [0] — po (r) is the probability of having no pho- 
ton in Eve's modes (i.e. no jump) after the attack and 
P^^[0, 0] = e~^ is the probability that there are photons 
neither in Eve nor in Bob's modes. 

By inverting Eq. (M) we find the transmissivity rj 
'mimicked' (in the sense of Eq. (p7[)) by the CBS attack. 



?7cBs = l--ln(l + Ai(l-7')). 



(22) 



Since t^cbs is an increasing function of 7^ and we know 
that this achieves its minimum for r — > 00 (7^ — > 0), we 
find that, given a mean photon number /i, the attack just 
described cannot mimic arbitrarily large channel losses. 
The minimum transmissivity is then given by 



Vc 



1 



-ln(l 



m)«^M-^m' + 0(m')- (23) 



This makes sense since for r — ^ cxd all non- vacuum signals 
will leak one photon to Eve while the remaining photons 
always reach Bob. It is clear, therefore, that the removal 
of only one photon cannot account for arbitrarily high 
channel losses. In order to meet Bob's expectations even 
when rj < 77™'", Eve can apply the protocol correspond- 
ing to ry™g" and then block the outgoing signals with a 
probability 



block 
-f'cBS 



1 



nfJ-V 



1 — gM^iSs" 



(24) 



Note that if the channel loss is equal to or larger than 
1 — ?7™ s" , then the probability of success is equal to the 
probability of having more than one photon in a signal 
pulse 



V'/CB 



succ,'^min^ 
"cBS 



/ie*^ 



(25) 



This means that for these high channel losses (i.e. 77 < 
^cBs") E^^ *^8,n extract one excitation from the signal with- 
out modifying Bob's expected number of non-vacuum 
signals. All Bob's non-vacuum contributions effectively 
come from the multiphoton part of the signal pulses, and 
Eve will possess one photon from each of those signals. 
Therefore she will obtain the full sifted key shared by Al- 
ice and Bob after the public announcement of the bases. 
This could never have happen if Eve had chosen the BS at- 
tack. This is a very important feature since Eve's knowl- 
edge of the full key does not leave any room for Alice and 
Bob to perform privacy amplification to obtain a secure 
key. 

Taking into account the blocking, in the regime of high 
losses, the success probability calculated in ( pl| ) takes the 
following form 



1 - ^0-^(1 - 7^) - e-(i-''')'^ : r] > 77™^' 



succ 

-PCBS 



block JJ SUCC ^ J^ _ g- 



m 



V < '7jr 



(26) 



In order to evaluate the performance of an attack it is 
more convenient to normalize the probability of success 
with the probability that Bob gets a non-vacuum signal 
(potential sifted key bit) to obtain the key fraction known 
by Eve, 



JCBS — 



^SUCC 



l-^cls[0]' 



(27) 



As discussed previously, for 77 < 77™'" Eve can acquire the 
whole key, so in this regime /cbs = 1- For other channel 
loss values the key fraction never reaches unity. Simi- 
larly one can define the same quantity for the BS attack 
obtaining 



Jbs — 



-Fb 



l-^B^s[0] 



= 1-e 



-ii-v)f^ 



(28) 



where we have made use of Eq. (g) and (|^) . It is easy 
to prove that the fraction of key known by Eve is always 
bigger for the CBS than for the BS attack. In Fig. g we 
can see these fractions as a function of the channel trans- 
missivity for a typical value of the mean photon number 
used in current experiments (see also Fig. g). 
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FIG. 2. Fraction of the key known by Eve in CBS (solid 
curve), BS (dotted) and pns (dashed) attacks for /j, = 0.1 



In order to compare quantitatively the CBS with the BS 
we define the performance quotient Ocbs = f- which is 
plotted in Fig. as a function of the mean photon number 
of the signal pulses and the channel transmissivity. 




FIG. 3. Performance quotient gcBs for the CBS. Since it is 
not bounded from above we have only plotted values smaller 
than five. 



We see that for small /i the CBS can be substantially 
better than the BS. For example, for the experimentally 
reasonable values /i = 0.1 and ?] = 0.1 the CBS provides 
Eve with a fraction of the key (Jcbs = 5.4 times bigger 
than the BS attack. For a fixed mean photon number fi, 
the optimum advantage q^^ = 1 + ^"^ is achieved when 
the channel losses are rj = r?™". 



III. CBS WITHOUT STORAGE 

There is an important fact that makes the CBS, as de- 
scribed above, rather more technically demanding than 
the BS. In order to follow the CBS protocol described in 
the previous section Eve has to be able to perform two 
experimentally non-trivial tasks Ig^l- f^) Firstly she has 
to detect the presence of photons in her modes Ug and 
be without altering their polarization. This is necessary 
because Eve has to be able to carry out the conditional 
dynamics, i.e. stop the splitting as soon as she gets the 
desired photon. This operation is not as technologically 
demanding as the PNS since it only needs to discriminate 
the non-vacuum states from the vacuum. However, it is 
out of reach of the immediately available technology, b) 
The second task Eve must be able to realize is to store 
the extracted photon until the encoding basis is publicly 
announced by Alice. 

In the conventional beam splitting attack Eve is not 
required to carry out task a). On the other hand, we 
notice that Alice can always delay the public announce- 
ment, making it harder for Eve to store coherently the 
signal and thereby, effectively constraining Eve to attacks 
that do not rely on the storage of the extracted signal. 
This of course applies to all the error-free attacks that 
we have seen in this paper, that is the PNS, BS and CBS. 
Inasmuch as Eve is forced to carry out the signal mea- 
surement before knowing the encoding basis, in the CBS 
attack she does not have to rely anymore on her ability 
to detect photons without disturbing their polarization 
(task a)). Eve can realize the conditional dynamics by 
directly measuring the extracted photons with photode- 
tectors. Acknowledging the impracticability of indefinite 
qubit storing, thus, puts on equal footing the BS and CBS 
as far as technological difficulty is concerned, and still 
leaves the pns as unfeasible. 

As in the previous section, we can now calculate the 
performance of the CBS in this new no-storage or direct 
measurement scenario. In this situation the CBS is bound 
to fail in half of the cases. Eve only succeeds when she 
measures the extracted photon in the right basis. The 
probability of success and key fraction in the directly 
measured conditional beam splitting (dcbs) will accor- 
dantly be reduced by a factor i, i.e. Pdcbs = ^PgbT ^^^ 
/dcbs — ^/cBs- Clearly, since the number of extracted 
photons is the same as in the scenario with the possi- 
bility of storage, the number of non-vacuum signal that 
arrive at Bob's site remains the same. 

The success probability for the directly measured beam 
splitting attack (dbs) can be calculated taking into ac- 
count that Eve's attack is unsuccessful only in the case 
where all split photons from a signal are measured pl| ] 
in the wrong basis. 



pZT = (1 - e- 



vt^) 



' ' On 



i /^"(i-^)" .-.a-.) 



(l-e-''^)(l-e-^(i-'')). 



(29) 



The fraction of the key known by Eve in this attack is 
therefore, 



/d 



1 



\ii-v) 



(30) 



Since for small /z the most important contribution in 
the BS comes from the two photon signals, as in CBS, the 
success probability of both attacks is reduced approxi- 
mately by the same factor i. But this factor is always a 
bit larger for DBS since in the cases where more than one 
photon per signal are split. Eve has a bigger chance to 
measure in the right basis. The performance quotient is 



/■ 



-¥^ and it is 

/DBS 



now defined relatively to the DBS, qoci 
plotted in Fig. H for relevant values of fi and 77. We see 
that for large mean photon numbers (/i > ln4 « 1.4) the 
DBS can actually perform slightly better than the DCBS 
for some range of channel losses (see also Figs, g and |j). 




FIG. 4. Performance quotient gocBs for the DCBS . Since it 
is not bounded from above we have only plotted values smaller 
than five. 

Despite this last remark it looks like the CBS maintains 
its efficiency over the BS under the no-storage constraint 
(compare Fig. ^ with Fig. ^), but in fact under this sce- 
nario the DCBS has lost the threatening feature of being 
able to extract the full key (/cbs = 1) for high channel 
losses (see Fig. ||). 

In the remaining of this section we will propose a vari- 
ation of the CBS which allows Eve to extract the full key 
even in the no-storage scenario, and to perform better 
than DBS for any mean photon number. The idea of the 
adapted conditional beam splitting attack (acbs) is to 
extract two photons, one by one, from the signal and 
measure each of them in a different polarization basis. 
In order to do that, Eve just has to follow the same pro- 
tocol as in the single photon CBS but instead of stopping 
the beam splitting as soon as she detects one photon, 
she has to continue the splitting until a second photon 
is extracted. As previously, in order to match the ex- 
pected number of photons in Bob's side, the splitting 



procedure can run for a maximum coupling time f af- 
ter which the signal must be transmitted to Bob through 
a lossless channel. Obviously, this attack will only be 
advantegeous in the no-storage scenario since otherwise, 
when the key can be extracted from the first photon, it 
is of no use to extract a second photon. 

The total probability that Bob gets a vacuum signal 
after the ACBS is 



P^cBsm=Po{f)p"M+ / Piih) 



Pll{t2\h)pl{li^i)dt2+Pw{T\h)p'i{li^i) 



= c-"(l+/i(l-7^) + ^(l-7l)'), 



dti 



(31) 



where PcifJ-) is the probability of having n photons in a 
coherent state with mean photon number fi, pii{t2\ti) = 
e^jf /ie'''-^'2~''ti' is the probability of having a jump at 
^2 conditional to a previous jump at ii, and Pio{f\ti) = 
gMiT^ 7t J J jg (-jjg probability of having no jump in the time 
interval [ii,f] conditional to a jump at ti. These prob- 
abilities can be calculated following the general results 
in the beginning of Sec. O. The previous result is equal 
to the corresponding probability in CBS (Eq.[l8|) plus a 
second order in fi term which represents the removal of 
two photons. 

The coupling time f can be now fixed so that Bob's 
probability of detecting at least one photon agrees with 
the result he would expect from the lossy channel. 



^«.Bsho] = p^bo] ^ pf,,M - p^m 



il 



= ! + -(!- V2e''(i-'') - 1). 



(32) 
(33) 



As expected we see that the maximum coupling time will 
be smaller for the ACBS than the CBS 7^ < 7? < 77. 

To calculate the probability of success we have to count 
the events in which Eve extracts a signal while leaving 
some non-vacuum contribution to Bob. We also have to 
take into account that Eve only gets the bit value with 
certainty when she manages to extract two single pho- 
tons, otherwise she will only get it in half of the cases. 
The success probability for the ACBS attack is then given 
by 
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-Faces 



piih) 



Pllit2\tl)p7hitJ.)dt2 + 



+ 2Pio(^|ii)Pc°(7lM) 



dti = 1 - e"^ 



a7?/i_ 
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where p^°(/x) is the probability of having at least one 
photon in a coherent state with mean photon number fi. 



By inverting Eq. ( |33| ) we find that the transmissivity 
'mimicked' (in the sense of Eq. (p2|)) by the ACBS attack 



77,cBs - 1 - ln(l + fi{l - 7l) + y(1 - 7l)')- (35) 

Since this is an increasing function of 7I we find the min- 
imum transmissivity that can be mimicked by the ACBS 
without extra blocking (for f ^ cx)) is 
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In this hmit of very high losses Eve can extract two 
excitations from all signals and still meet Bob's expecta- 
tions. Therefore, by measuring each photon in a different 
basis, she will be able to acquire the full key even in the 
no-storage scenario ( /acbs = p^^'T ni = !)■ If the losses 
are still higher (77 < 77™,™) Eve has to block some signals 
with probability 
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-fsi. In 

/DBS 



The performance quotient is now (/acbs — i 
Fig. |5| we can see the values of this ratio as a function 
of the tranmissivity of the channel and the mean pho- 
ton number. Notice that in this case the performance 
quotient is larger than unity for all values of the mean 
photon number, which means that the ACBS is more effi- 
cient than DBS. On the other hand, for low mean photon 
numbers (/i < 1), higher losses are required to achieve 
the same performance as the dcbs (see also Figs. and 



times bigger than the DBS attack. In Fig. || we can see the 
behavior of the performance quotient as a function of the 
mean photon number for a fixed value of the losses. We 
observe that, contrary to the other attacks, for a fixed 
transmissivity of the channel 77, the efficiency of ACBS 
over DBS can increase with /i. For example, if the mean 
photon number of the previous example is increased to 
fi — 1.1 keeping the transmissivity in 77 = 0.1 the effi- 
ciency factor grows to Qacbs — 2.48. 
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FIG. 6. Performance quotient at a fixed transmissivity 

77 = 0.1 for the ACBS (solid), DCBS (dotted) and CBS (dashed). 

In Fig. ItI we represent which of the studied attacks is 
most effective in the no-storage scenario for different val- 
ues of the parameters /i and rj. As a summary, in Fig. g 
we show the key fraction as a function of the losses for 
four different values of the mean photon and for the dif- 
ferent attacks studied in this paper. For comparison, the 
results for the PNS in the storage and no-storage scenar- 
ios are also plotted. Once again, we notice that the CBS 
and ACBS provide real alternatives to the, at present, un- 
feasible PNS and the ineffective BS. 




FIG. 5. Performance quotient Qacbs for the ACBS. 

We see that the acbs can still be substantially better that 
the DBS. For the values /z = 0.1 and rj = 0.1 the ACBS 
attack provides Eve with a fraction of the key (/acbs = 1.3 
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FIG. 7. Diagram of dominance of the different attacks 
under no-storing conditions: I./dcbs > /acbs > /dbs, 

^•/acbs ^ /dcbs ^ /dbs and O.J ACBS di /dbs -^ /dcbs 
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FIG. 8. Key fraction for different scenarios (Black: no-storage allowed, Gray: storage allowed) and attacks (Solid: CBS, 
Dashed: acbs, Dotted: bs, Dot-dash: pns). 



IV. PHOTON STATISTICS 

The task of an eavesdropper is to acquire knowledge 
about the secret key that Alice and Bob want to share. 
But the important point is that she does this without 
leaving any trace in the signal that could indicate her 
presence to Alice and Bob. Eve's eavesdropping capabil- 
ities are therefore strongly dependent on the capabilities 
of Alice and Bob to prepare and analyze their signals. 
In this work we have assumed that Alice is not able to 
prepare single photon signals, using instead very weak 
coherent states. Moreover, we have assumed that Bob's 
capabilities are limited as well by a detection setup that 
gives the same outcome for single photons than for multi- 
photon signals. In this situation Eve has only to forward 
signals to Bob in such a way that expected number of 
non-vacuum signals is the same as for the lossy channel, 
as expressed in Eq.(|l7|). 

In this section we will study what happens in the sit- 
uations where Bob's capabilities are not so poor. In par- 
ticular we consider the realistic situation in which Bob's 
analyzer is a polarizing beam splitter (in two possible ori- 
entations according to the basis measured) with a photon 
detector in each of its arms. We will assume that these 
detectors do not have photon number resolution, so that 
they only have two possible outcomes corresponding to 
non-vacuum ('click') and vacuum (no 'click') impinging 
signals. 



When Bob and Alice bases coincide, only one of Bob's 
detectors can click and Eve remains safe. But in the case 
that Bob measures in a different basis than the encod- 
ing basis, the multiphoton part of the signal can lead 
to simultaneous clicks in both detectors. Here is where 
Eve can reveal her presence depending on what attack 
she chooses. Bob is expecting to receive a weak coherent 
state of a given amplitude (determined by the amplitude 
of the selected coherent state and by the channel losses) 
and therefore an expected number of these double clicks. 
The probability of these double clicks without Eve's in- 
tervention (or under the BS attack) is given by 
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(38) 



where the factor ^ accounts for the probability that Alice 
and Bob use different basis. 

When Eve tries to eavesdrop using the CBS attack with- 
out extra blocking (i.e -q > ry™") the probability of double 
counts is, 
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= 2-— (4e"-l-M(l-7')-2e-^). (39) 

By using (M) to express 7r in terms of the the channel 
losses, and taking into account the blocking probability 



(24) for 7] < ?7™™ we plot in Fig. ||the ratio of both 
probabilities q^^^ = ^af as a function of the mean photon 
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number and channel transmissivity. 
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FIG. 9. Ratio of the CBS and BS double-click probabilities. 

We see that the CBS increases the probability of double- 
clicks relative to the lossy channel. The reason for this 
increase is that the CBS only takes one photon out while 
several signal photons might be lost in the lossy chan- 
nel. For increasing transmissivities the differences tend 
to vanish. So, for example /i ~ {0.1,0.01} and 77 = 0.3 
lead to Qdc — {1-1, 1.02}. But for higher losses the ratio 
can be quite high, e.g for fi = {0.1,0.01} and 77 = 0.1 
Qdc = {3.45, 1.2}. Inclusion of the effect of dark counts 
in Bob's detectors in pf.^^ shows only a slight reduction 
of the discrepancies for reasonable dark count probabil- 
ities {p-£) ~ 10~^). Even though this is a definite hand- 
icap of the CBS it might be of relative importance in 
practice. The probability of double counts is very small 
(^pdc ^ L(^j^ij^2^ while the statistical fluctuations are large, 
therefore the number of transmitted signals needed to 
appreciate Eve's intervention might be exorbitant. As 
shown in Fig. O, for some parameter regimes one can 
find a good compromise between the probability of suc- 
cess and the double-count rate. 

Moreover, as we shall see next, the disparity in the 
number of double-clicks can be further decreased if Eve 
uses the two-photon splitting adopted for the non-storage 
conditions (acbs). The double-click probability in this 
case is 
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In Fig. M we can see the ratio between this probabil- 
ity and the corresponding probability for the lossy chan- 

dc 

nel g^cBs = tI^j taking into account the blocking for 

Pes 

77 < 77™3g. In Fig. O the same quantity is compared to 
the performance quotient. 
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FIG. 10. Ratio of the acbs and BS double-click probabili- 
ties. 
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FIG. 11. Double-click ratio (solid) and performance quo- 
tient (Dashed) at a fix /i = 0.1 for CBS and dcbs (top) and 
ACBS(bottom) 

We see that for the ACBS attack the double click probabil- 
ity takes nearly the same values as for the lossy channel 
(/i = 0.1 and ?7 = 0.1 give qdc — 1.05) while still providing 
larger key fractions than the BS attack. 



V. MIXED STRATEGIES 



In the previous sections Eve's attacks were character- 
ized by only one parameter 7,-. Once the type of attack 



was chosen (CBS, ACBS) she could only vary the coupling 
time r to tune her attack. In this section we will study 
the situation in which Eve can use mixed strategies, i.e. 
for each signal she can choose a different coupling time. 
In this way, Eve has the freedom to choose a probabil- 
ity distribution {pi} according to which she will apply 
a coupling time Ti (i.e. TtJ- A mixed strategy could 
in principle lead to a lowering of the double-click proba- 
bility without sacrificing to much probability of success. 
Unfortunately we will see that this is not the case for the 
CBS and ACBS. 

We start by considering the CBS attack. In this case 
the number of non-vacuum signals received by Bob ( pq ) 
is linearly dependent on 7^. , therefore the mixed strategy 
has to be such that the average value of 7^. is equal to 
the pure strategy value fixed in Eq. (|l9|), i.e. 

i 

= J2p.c-^{1 + m(1 - 7^.)) = P^^sM (41) 

i 

— >^p,7'. =7r- (42) 

i 

Now we want to know what is the behavior of the 
probability of success and of the double-clicks when using 
mixed strategies. From Jensen's inequality [E2| we know 
that 



fix) < ^=^ Y.p^fi''^^) < f(J2p^^' 



(43) 



Since Eq. (B2) assures that Bob gets the expected num- 
ber of clicks we find, by using Eq. (pi|), that the mixed 
strategy always leads to a smaller probability of success 
than a pure one 
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Similarly one can easily see that the probability of 
double-clicks in the CBS p^^g ( ^ increases when mixing 
strategies. Since we already saw that the double-click 
probability is higher than for the lossy channel we arrive 
to the conclusion that using mixed strategies does not 
offer any advantages to the CBS attack. 

The same happens in the two-photon conditional beam 
splitting (acbs). To prove this, one has to write the 
probability of success and of double-clicks as a function 
of Bob's probability of receiving a non-vacuum signal, 
and check for its concavity/covexity. 



VI. CBS WITH FINITE BEAM SPLITTERS 

In this section we will see how to implement the CBS 
attack with finite reflectivity beam splitters. The beam 



splitters have now a finite reflectivity |rp (and transmis- 



sivity |i| = 1 



- ) . Without any loss of generality we 



will assume that r and t for the signal are real. We also 
assume that they are independent of polarization. 

The initial state can be written as {(po) = \a; /3) |0;0) 
where the first ket is Alice's coherent state and the sec- 
ond is Eve's mode. After the first beam splitter the state 
of the system is 



1) ^\ta;tp)\ra;r(3) 
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Notice that Eve's and the signal modes are still in a sep- 
arable state. This means that Bob's state will be the 
same independently of what Eve does to her modes. For 
coherent input states, Bob's state will depend only on 
the number of beam splitters put in by Eve during the 
attack. Eqs.(|l^) and (15) reflect this situation in the 
infinitesimal beam splitting case. This simplified the cal- 
culations leading to the results in this paper, but the 
quantum jump method described in Sec. O can be used 
to describe the conditional beam splitting for any kind 
of input as long as Eve's modes are in the vacuum state 
initially 0. 

After the first beam splitter Eve will try to detect 
the presence of photons in her modes. With probabil- 



ity p? = P°ir^{\c 



')) 



she will detect no 



photon. If this happens she will split the signal with a 
second beam splitter. She will repeat this process until 
she detects some photons in her modes. After the m*'* 
beamsplitting the state of the system is 



,) = li'^a; i™/5) |rt™-ia; rt™" V) 



(46) 



To keep the notation simple, we are omitting here the 
tested vaccum modes of earlier beam splitters. The total 
probability of reaching this state is. 
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Therefore the total probability that Eve detects some sig- 
nal after the m*'' beam splitter is 
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If this event occurs, the splitting stops and the signal 
is sent to Bob through the lossless channel. Otherwise 
Eve keeps on adding beam splitters until she reaches a 
maximum number N of attempts. After the conditional 
beam splitting attack with finite beam splitters (cbsf). 
Bob will therefore receive a coherent state |0m^) — |i™a) 
with probability p'^ for m = 1 ... A^— 1 or pi^ for m = N . 
From here one can calculate the probability of vacuum 
signals arriving at Bob's site in the cbsf 
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The probability of success of the CBSF attack is, 
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Notice that Eqs. (EM) and (M^) and the derived quantities 
are in agreement up to first order in r^ with the corre- 
sponding probabihties for the infinitesimal CBS derived 
with the quantum jump method, i.e. Eqs. ( p^ and jig ) 
(with r^ = ^e^). 

In order to match Bob's probability of detecting a non- 
vacuum signal with the result he would expect from the 
lossy channel. Eve has now two free parameters: the max- 
imum number N of beam splitters used and their trans- 
mission amplitude t. From the infinitesimal CBS results 
we know that for small reflection coefficients (i.e. t ^ 1), 
t^^ ~ -^2 ^ajjjjig ^2 fj-Qjjj gq (j^^ Of course, for a finite 
A'^ this approximation will not hold when we are in or 
near the region rj < 77™'" which corresponds to r — )■ cx). 
The reason for this is that now we are dealing with fi- 
nite beam splitters and accordingly, for any given N, we 
can 'mimic' a lossy channel with arbitrarily high losses. 
For the same reason now we are not forced to block any 
signals as done for the CBS in the high losses regime. 

To get the quantitative results presented in the rest of 
this section we have to find numerically the condition on 
Eve's free parameters (i and N) such that Bob's expecta- 
tions on the number of non-vacuum signals are fulfilled. 
For a given N we use Newton's method to find the value 
of t for which P<?Bgp[0] dH) equals to ^^^[0] (||), taking 
a starting value of to — tj^n . 



In Fig. y_2| and |13| we have plotted the performance 
quotient (7cbsf = ^^ as a function of /z and 77 for an 
attack using a maximum of two and ten beams splitters 
respectively. 




FIG. 12. Ratio between the CBSF with two beam splitters 
and the BS success probabihties. 
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FIG. 13. Ratio between the CBSF with ten beam splitters 
and the BS success probabihties. 



We notice that doing CBSF with only two beam splitters. 
Eve already obtains a much bigger fraction of the key 
than with the standard beamsplitting attack, e.g for /i = 
0.1 and rj = 0.1 the key she obtains is q^^^ = 2.5 times 
longer. With ten beam splitters she almost reaches the 
infinitesimal result (compare with Fig. 0). For /i = 0.1 
and -q = 0.1 the key she obtains is g^sF^^ — 4.7 times 
longer. 



In Fig. |lj we can compare the key fraction obtained 
with the BS, CBS and CBSF with different numbers of 
beam splitters. 
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FIG. 14. Key fraction for CBS (solid), CBSF with N=2 
(Dotted), N=5 (Short-dashed), N=10 (Long-dashed) and BS 
(Dash-dotted). 

The number of double-clicks in Bob's detectors when he 
measures in the wrong basis can be calculated from 
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The ratio between the double-click probabilities of the 
BS and CBSF for various values of iV, is plotted Fig. [ll] 
together with the corresponding performance quotients. 
This figure shows that, depending on the parameter 
regime, an attack with a small number of finite beam 
splitters might be more suitable than the infinitesimal 
CBS in that the number of double clicks is much closer 
to its lossy channel values. 
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FIG. 15. Quality factors (black) and double-click ratio 
(Gray) for CBS (solid), CBSF with N=2 (Dotted), N=5 
(Short-dashed), N=10 (Long-dashed). 



VII. CONCLUSION 



photon level, with the current technology. Until now the 
technologically possible alternative to the pns has been 
the simple beam splitting attack [g^. For high losses (i.e. 
long transmission distances) the BS attack turns out to be 
very ineffective. Here we have presented the conditional 
beam splitting attack which also requires only linear op- 
tical elements and is therefore feasible with present tech- 
nology, but is much more efhcient than the conventional 
beam splitting attack. The CBS attack, thus, shortens 
substantially the gap in performance between the ideal 
and practical eavesdropping attacks. This is of great im- 
portance if one considers that the eavesdroppers success 
in a quantum key distribution attack is dictated by the 
technology at the moment of the signal transmission. In 
contrast with the case of classical cryptographic proto- 
cols, no future technologies can help unveil present key 
exchanges. 

Starting from the simplest scenario in which Eve is ca- 
pable of storing her signals until the encoding basis is 
announced, we have moved to more realistic situation in 
which Eve has no storing capabilities. For this situation 
an adapted CBS attack, based on the extraction of two 
single photons, has been proven to be advantageous for 
some relevant parameter regimes. 

Numerical results for the implementation of CBS with 
finite reflectivity beam splitters show that using only two 
beam splitters one can easily duplicate the efficiency of 
the conventional beam splitting, and that the infinitessi- 
mal CBS results are reached with the use of a few beam 
splitters. 

The photon statistics at Bob's detectors has been stud- 
ied and shown to be a matter of concern in this type of 
attack. However, we argue that, if handled with care, 
this drawback does not disqualify the CBS attacks. We 
believe that further elaborations of this basic idea can 
lead to attacks which are specialized for certain parame- 
ter regimes and other protocols. 
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In this paper we have introduced a novel attack on 
weak coherent pulse quantum key distribution in lossy 
channels. The conditional beam splitting takes advan- 
tage of the multiphoton component of the transmitted 
signals to extract information on the encoded bit. This 
task is accomplished optimally using the photon number 
splitting attack. However, the implementation of the PNS 
attack entails a quantum non demolition measurement 
which is something unattainable, at least at the single 
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